XS::libbrotli versions before 1.2.1.0 for Perl include a bundled brotli library with an out-of-bounds write vulnerability in the decoder. This flaw can be triggered by an attacker supplying a crafted brotli stream to any dependent module that decompresses untrusted data, potentially leading to memory corruption, information disclosure, process crashes, or arbitrary code execution. The vulnerability arises because the bundled brotli versions 1.0.7 or 1.1.0 contain the decoder flaw described in CVE-2026-111497. Upgrading the system brotli library does not mitigate this issue; only upgrading XS::libbrotli to version 1.2.1.0, which updates the bundled brotli to 1.2.1, resolves the vulnerability.